How to redact a PDF so the text is really gone

Drawing a black box over a name looks like redaction. Very often it isn't. The text is still in the file, and anyone can copy it out from under the box. Here's how to redact a PDF properly, and how to check that it worked.

Why a black box isn't enough

A PDF is built in layers. When you draw a black rectangle over a line, you add a new object on top. The text underneath is untouched. Anyone who selects the area and copies it, searches for the word, or simply deletes the rectangle can read what you tried to hide.

This isn't a theoretical risk. It has happened in published court filings and official reports, where "redacted" passages turned out to be readable by anyone who copied and pasted them.

Other methods that don't work

• Black highlighting. Same problem as the box. The text stays in the file.
• Changing the text colour to white or black. The words are still there, just hard to see.
• Cropping a page. The part you cropped away is often still stored in the file.
• Covering text in a word processor before exporting to PDF. Sometimes the covered text survives the export, sometimes it doesn't. You can't tell by looking.

What proper redaction does

A real redaction tool removes the characters from the text layer and the pixels from any images under the marked area, then fills the area with a solid block. Some tools go one step further and rebuild each redacted page as an image, so there's no text layer left at all. That's the safest option. The trade-off is that those pages can no longer be searched.

Don't forget the hidden parts

The visible page is only part of a PDF. Before you send a redacted file, check for:

• Metadata. Author name, title and sometimes the company, stored in the document properties.
• Comments and annotations that may quote the very thing you redacted.
• Form fields that still hold filled-in values.
• Bookmarks and attachments.
• The text layer under a scan. If a scanned page was run through OCR, there's invisible text behind the image. Blacking out the image doesn't touch it.

What to redact

The obvious ones: names, national ID or social security numbers, tax numbers, bank account numbers, phone numbers, email addresses, home addresses and signatures. Then think about indirect details. A job title plus a small team name can identify a person just as clearly as a name.

Find every occurrence

The detail you want to hide rarely appears just once. A name shows up in the header of every page, an account number is repeated on the payment page, an email address sits in the signature block and again in the footer. Hiding the first one and missing the third is the most common way a careful redaction fails.

Before you mark anything, search the document for each item and note every page it appears on. Search for variations too: the number with and without spaces, the name with and without a middle initial, the email address in capitals. Then redact them all in one pass, and search again afterwards.

A worked example

Mia is sending a copy of her tenancy agreement to a new flatmate. She wants to hide her ID number and her bank details.

First attempt: she draws black rectangles in a free PDF editor. It looks perfect. Then she presses Ctrl+F and types the first digits of her ID number. The search finds it, under the box. She selects the area, copies it into a text editor, and there it is in full.

Second attempt: she uses a real redaction tool. This time the search finds nothing, and copying the area gives an empty result. One last check: the document properties still list her full name as the author, from when she first scanned it. She clears that too. Now the file is safe to send.

Test every redacted file

1. Search for each word or number you redacted.
2. Select all the text, copy it and paste it into a plain text editor.
3. Open the file in a second PDF viewer.
4. Check the document properties.

If all four come back clean, the redaction worked.

Where the original goes matters

Most online redaction tools ask you to upload the unredacted original, which is exactly the document you're trying to protect. ClearRead's redact tool runs on your own device instead: nothing is uploaded, the text under the marked area is really deleted, and redacted pages are rebuilt as images and checked afterwards.

Before you send the next one

Next time you share a document with something blacked out, run the four-step test first. It takes a minute, and it's the only way to know the box is doing its job.